s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

CVE-2026-56846

📛 CVE Title

CVE-2026-56846

⬇ Download JSON ⚠ View as Threat

Description

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.

Overview

State
PUBLISHED
Assigner (CNA)
hackerone
CVSS severity
HIGH
CVSS score
CVSS 7.5 / 10 7.5 7.5 / 10
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Effective score
7.5 / 10 HIGH source: CNA overview
CWE(s)
CWE-400
Reserved
2026-06-23
Published
2026-08-04 00:49 UTC
Last updated
2026-08-04 00:49 UTC
Source
https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/56xxx/CVE-2026-56846.json
Linked Threat
CVE-2026-56846 — CVE-2026-56846

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published
2026-08-04 01:16:19 UTC
NVD last modified
2026-08-04 01:16:19 UTC
EPSS score
0.0055 (probability of exploitation in next 30 days)
EPSS percentile
42.83% vs all CVEs — higher = more likely to be exploited, as of 2026-08-04

NVD / KEV / EPSS data refreshed 2026-08-04 14:56 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID
EUVD-2026-52564
Assigner
hackerone
Published
Aug 4, 2026, 12:49:58 AM
Updated
Aug 4, 2026, 3:03:38 PM
EUVD base score (CVSS 3.0)
7.5 / 10
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EUVD-reported EPSS
0.0000
Vendors
nodejs
Products
Node (22.23.1 ≤22.23.1)
Node (24.18.0 ≤24.18.0)
Aliases
GHSA-frc8-j9wv-2348

ENISA description: A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.

EUVD references (1)

Microsoft Security Response Center MSRC

Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-08-04 14:56 UTC.

Microsoft returned no record for this CVE (it may not be a Microsoft-issued CVE).

Affected products (1)
VendorProductVersionsPlatforms
nodejs node 24.18.0 (affected), 22.23.1 (affected) —

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

MITRE references (1) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Web references (10)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search. Last searched: 2026-08-04 17:59 UTC.

  • CVE-2026-56846 Common Vulnerabilities and Exposures | SUSE web:www.suse.com

    Secure your Linux systems from CVE-2026-56846 . Stay ahead of potential threats with the latest security updates from SUSE.

  • Security Update Guide - Microsoft web:msrc.microsoft.com

    The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

  • CVEs and Security Vulnerabilities - OpenCVE web:app.opencve.io

    Explore the latest vulnerabilities and security issues in the CVE database

  • NVD - Home web:nvd.nist.gov

    The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...

  • Node.js Patches 11 Vulnerabilities Including HTTP/2 Flaws web:securityonline.info

    Node.js patched 11 vulnerabilities in its July 2026 release. The high-severity bugs include a HTTP/2 use-after-free ( CVE - 2026 -56848). Update now.

  • Known Exploited Vulnerabilities Catalog - CISA web:www.cisa.gov

    For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. Learn more about ...

  • CISA Adds Two Known Exploited Vulnerabilities to Catalog web:www.cisa.gov

    While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Aware of an exploited vulnerability not currently listed in the KEV ...

  • Fortinet: 'Critical' FortiClient EMS Vulnerability Exploited In Attacks web:www.crn.com

    Fortinet disclosed that it has observed exploitation of a vulnerability in its FortiClient EMS (Enterprise Management Server) platform, prompting the release of an emergency patch.

  • Database CVE, CWE, CISA KEV & Vulnerability Intelligence | CVE Find web:www.cvefind.com

    CVE Find is a cybersecurity intelligence platform indexing CVEs , CWEs, CAPEC, CVSS, EPSS and threat data. Search, track, and analyze known vulnerabilities and exploit risks.

  • National Vulnerability Database | NIST web:www.nist.gov

    NIST maintains the National Vulnerability Database (NVD), a repository of information on software and hardware flaws that can compromise computer security. This is a key piece of the nation's cybersecurity infrastructure.

NVD-tagged references (1)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-56846.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThanOrEqual": "24.18.0",
              "status": "affected",
              "version": "24.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "22.23.1",
              "status": "affected",
              "version": "22.23.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.\r\n\r\nThis vulnerability affects Node.js **24.x** and **22.x**."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T00:49:58.319Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-56846",
    "datePublished": "2026-08-04T00:49:58.319Z",
    "dateReserved": "2026-06-23T15:00:03.632Z",
    "dateUpdated": "2026-08-04T00:49:58.319Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}